Memory corruption in MagickQueryMultilineFontMetrics()

[fisheggs]

At line 580 in wand/magick-wand.c

font_metrics=(double *) AcquireMagickMemory(7*sizeof(*font_metrics));

Then it puts 13 values in space reserved for 7...... boom

Oops, forgot to mention:

Version: ImageMagick 6.3.5 07/09/07 Q16 http://www.imagemagick.org

compiled from ImageMagick-6.3.5-0.tar.gz on x86_64 GNU/Linux

[magick]

We have a patch in ImageMagick 6.3.5-1 Beta to fix the problem you reported. Thanks.

[fisheggs]

Thank you.